github/kubernetes
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Allow securityContext in EphemeralContainers

Browse Source
This commit is contained in:
Lee Verberne 2021-02-12 10:44:54 +01:00
parent 07358f1663
commit 70765fa24d
5 changed files with 21 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
pkg/api/pod/util_test.go
View File

@ -1359,12 +1359,12 @@ func TestDropEphemeralContainers(t *testing.T) {
pod func() *api.Pod pod func() *api.Pod
}{ }{
{ {
description: "has subpaths", description: "has ephemeral containers",
hasEphemeralContainers: true, hasEphemeralContainers: true,
pod: podWithEphemeralContainers, pod: podWithEphemeralContainers,
}, },
{ {
description: "does not have subpaths", description: "does not have ephemeral containers",
hasEphemeralContainers: false, hasEphemeralContainers: false,
pod: podWithoutEphemeralContainers, pod: podWithoutEphemeralContainers,
}, },

3
pkg/apis/core/types.go
View File

@ -3140,7 +3140,8 @@ type EphemeralContainerCommon struct {
TerminationMessagePolicy TerminationMessagePolicy TerminationMessagePolicy TerminationMessagePolicy
// Required: Policy for pulling images for this container // Required: Policy for pulling images for this container
ImagePullPolicy PullPolicy ImagePullPolicy PullPolicy
// SecurityContext is not allowed for ephemeral containers. // Optional: SecurityContext defines the security options the ephemeral container should be run with.
// If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext.
// +optional // +optional
SecurityContext *SecurityContext SecurityContext *SecurityContext

1
pkg/apis/core/validation/validation.go
View File

@ -85,6 +85,7 @@ var allowedEphemeralContainerFields = map[string]bool{
"TerminationMessagePath": true, "TerminationMessagePath": true,
"TerminationMessagePolicy": true, "TerminationMessagePolicy": true,
"ImagePullPolicy": true, "ImagePullPolicy": true,
"SecurityContext": true,
"Stdin": true, "Stdin": true,
"StdinOnce": true, "StdinOnce": true,
"TTY": true, "TTY": true,

23
pkg/apis/core/validation/validation_test.go
View File

@ -5822,7 +5822,7 @@ func TestValidateEphemeralContainers(t *testing.T) {
TargetContainerName: "ctr", TargetContainerName: "ctr",
}, },
}, },
"All Whitelisted Fields": { "All allowed Fields": {
{ {
EphemeralContainerCommon: core.EphemeralContainerCommon{ EphemeralContainerCommon: core.EphemeralContainerCommon{
@ -5848,9 +5848,14 @@ func TestValidateEphemeralContainers(t *testing.T) {
TerminationMessagePath: "/dev/termination-log", TerminationMessagePath: "/dev/termination-log",
TerminationMessagePolicy: "File", TerminationMessagePolicy: "File",
ImagePullPolicy: "IfNotPresent", ImagePullPolicy: "IfNotPresent",
Stdin: true, SecurityContext: &core.SecurityContext{
StdinOnce: true, Capabilities: &core.Capabilities{
TTY: true, Add: []core.Capability{"SYS_ADMIN"},
},
},
Stdin: true,
StdinOnce: true,
TTY: true,
}, },
}, },
}, },
@ -5923,7 +5928,7 @@ func TestValidateEphemeralContainers(t *testing.T) {
field.Error{Type: field.ErrorTypeNotFound, Field: "ephemeralContainers[0].targetContainerName"}, field.Error{Type: field.ErrorTypeNotFound, Field: "ephemeralContainers[0].targetContainerName"},
}, },
{ {
"Container uses non-whitelisted field: Lifecycle", "Container uses disallowed field: Lifecycle",
[]core.EphemeralContainer{ []core.EphemeralContainer{
{ {
EphemeralContainerCommon: core.EphemeralContainerCommon{ EphemeralContainerCommon: core.EphemeralContainerCommon{
@ -5942,7 +5947,7 @@ func TestValidateEphemeralContainers(t *testing.T) {
field.Error{Type: field.ErrorTypeForbidden, Field: "ephemeralContainers[0].lifecycle"}, field.Error{Type: field.ErrorTypeForbidden, Field: "ephemeralContainers[0].lifecycle"},
}, },
{ {
"Container uses non-whitelisted field: LivenessProbe", "Container uses disallowed field: LivenessProbe",
[]core.EphemeralContainer{ []core.EphemeralContainer{
{ {
EphemeralContainerCommon: core.EphemeralContainerCommon{ EphemeralContainerCommon: core.EphemeralContainerCommon{
@ -5962,7 +5967,7 @@ func TestValidateEphemeralContainers(t *testing.T) {
field.Error{Type: field.ErrorTypeForbidden, Field: "ephemeralContainers[0].livenessProbe"}, field.Error{Type: field.ErrorTypeForbidden, Field: "ephemeralContainers[0].livenessProbe"},
}, },
{ {
"Container uses non-whitelisted field: Ports", "Container uses disallowed field: Ports",
[]core.EphemeralContainer{ []core.EphemeralContainer{
{ {
EphemeralContainerCommon: core.EphemeralContainerCommon{ EphemeralContainerCommon: core.EphemeralContainerCommon{
@ -5979,7 +5984,7 @@ func TestValidateEphemeralContainers(t *testing.T) {
field.Error{Type: field.ErrorTypeForbidden, Field: "ephemeralContainers[0].ports"}, field.Error{Type: field.ErrorTypeForbidden, Field: "ephemeralContainers[0].ports"},
}, },
{ {
"Container uses non-whitelisted field: ReadinessProbe", "Container uses disallowed field: ReadinessProbe",
[]core.EphemeralContainer{ []core.EphemeralContainer{
{ {
EphemeralContainerCommon: core.EphemeralContainerCommon{ EphemeralContainerCommon: core.EphemeralContainerCommon{
@ -5998,7 +6003,7 @@ func TestValidateEphemeralContainers(t *testing.T) {
field.Error{Type: field.ErrorTypeForbidden, Field: "ephemeralContainers[0].readinessProbe"}, field.Error{Type: field.ErrorTypeForbidden, Field: "ephemeralContainers[0].readinessProbe"},
}, },
{ {
"Container uses non-whitelisted field: Resources", "Container uses disallowed field: Resources",
[]core.EphemeralContainer{ []core.EphemeralContainer{
{ {
EphemeralContainerCommon: core.EphemeralContainerCommon{ EphemeralContainerCommon: core.EphemeralContainerCommon{

3
staging/src/k8s.io/api/core/v1/types.go
View File

@ -3525,7 +3525,8 @@ type EphemeralContainerCommon struct {
// More info: https://kubernetes.io/docs/concepts/containers/images#updating-images // More info: https://kubernetes.io/docs/concepts/containers/images#updating-images
// +optional // +optional
ImagePullPolicy PullPolicy `json:"imagePullPolicy,omitempty" protobuf:"bytes,14,opt,name=imagePullPolicy,casttype=PullPolicy"` ImagePullPolicy PullPolicy `json:"imagePullPolicy,omitempty" protobuf:"bytes,14,opt,name=imagePullPolicy,casttype=PullPolicy"`
// SecurityContext is not allowed for ephemeral containers. // Optional: SecurityContext defines the security options the ephemeral container should be run with.
// If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext.
// +optional // +optional
SecurityContext *SecurityContext `json:"securityContext,omitempty" protobuf:"bytes,15,opt,name=securityContext"` SecurityContext *SecurityContext `json:"securityContext,omitempty" protobuf:"bytes,15,opt,name=securityContext"`